# nslookup.exe

Windows Process: Microsoft Corporation

Also called nslookup, name server lookup, dns lookup

Windows, System Component

DNS lookup command-line tool. It queries name servers interactively or once. It is not a service host.

## What you need to know

nslookup queries DNS, it is not a service host.

nslookup.exe is a DNS client tool. You run it, it asks a resolver, it prints records. svchost.exe can host the DNS Client service (Dnscache). Ending nslookup does not stop name resolution for the rest of Windows.

- **Safe?**: Yes, in System32

  **Is it a service?**: No. It is a CLI you run

  **Can I end it?**: That lookup session ends

Feex says

If nslookup is on the list, I treat it as a prompt someone opened. I do not end Dnscache to close that CLI, and I do not call this a service host.

## What is nslookup.exe?

nslookup queries DNS, it is not a service host. The image is a console tool in System32. Cached resolution for apps lives in the DNS Client service, not in this exe.

## What does it do?

It sends queries and prints A, AAAA, MX, and other records. It does not host Svchost groups and it does not replace ping.

## Why is it running?

You or a script launched nslookup. An interactive session stays until you type exit. A one-shot query should exit.

## Is it safe?

Usually safe

System32 nslookup.exe is Microsoft. An nslookup.exe in Downloads is not. A long-running copy is still a CLI, not Dnscache.

A legitimate copy normally runs from:

`C:\Windows\System32\nslookup.exe`

- DNS lookup CLI
- DNS Client service is a svchost, not this file
- Expected publisher: Microsoft Corporation

## Can I end it?

Closes that lookup

Ending nslookup.exe stops that tool. Windows name resolution continues. Restarting DNS Client is a different, service-level action.

## Can I remove it?

No

Do not delete nslookup.exe. You would lose the inbox lookup tool. Disabling DNS Client is not how you remove this CLI, and you should not delete System32.

## Should it start with Windows?

A script can start it. It is not an inbox service and not Startup Apps by default.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Low

  **Memory**: Small

  **Disk**: Low

  **Network**: DNS queries to the server you pointed at

## File information

| Executable name        | nslookup.exe                     |
| ---------------------- | -------------------------------- |
| Common legitimate path | C:\Windows\System32\nslookup.exe |
| Publisher              | Microsoft Corporation            |
| Signature expectation  | Signed by Microsoft Windows      |

## Common problems

### People restart "DNS Client" because an nslookup window stayed open

Type exit or end this CLI. The service cache is unrelated to one open tool.

### A scheduled nslookup they mistake for malware hosting

Read the command line. A System32 copy querying a name is the tool. A namesake in Temp is the exception.

## Troubleshooting

Diagnose before you change anything destructive.

### Run nslookup from cmd or pwsh and watch it exit

Interactive mode needs exit. That is this exe. services.msc will not show nslookup as a service.

### For broken resolution in browsers, check DNS Client and the adapter

This tool is only a probe. Ending nslookup will not flush the cache. Use ipconfig /flushdns for that.

## Technical details

Technical details

| Image name | nslookup.exe                 |
| ---------- | ---------------------------- |
| Role       | DNS lookup command-line tool |

## Related

These entities connect to this article. Type is shown on every link.

[cmd.exe: Application Process](https://feex.it/wiki/process/cmd.exe)[pwsh.exe: Application Process](https://feex.it/wiki/process/pwsh.exe)[Process vs service: Guide](https://feex.it/wiki/software/system/process-vs-service)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: nslookup ](https://learn.microsoft.com/windows-server/administration/windows-commands/nslookup)· DNS lookup command-line tool
- [Microsoft Learn: Windows ](https://learn.microsoft.com/windows)· Primary Windows documentation
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: nslookup.exe

  **Typical path**: C:\Windows\System32\nslookup.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/nslookup.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)